Imagetovideogen

The Terms state users retain rights to content they submit, which is favorable. However, the same clause grants the vendor a broad worldwide license over that content, and the documents never specifically address uploaded reference images or prompts as distinct inputs. Overall ownership stays with the user but the accompanying license is expansive.

The documents are silent on ownership of AI-generated video output. The Terms address only user-submitted 'content' and vendor-owned website content, leaving the ownership status of generated videos undefined. This silence is a significant risk for a generation tool whose entire purpose is producing output.

The policies never mention model training or use of user inputs to improve AI models. The broad license to 'use, reproduce, modify, and distribute' content combined with a stated purpose to 'improve our services' could plausibly encompass training use, but nothing is disclosed. This silence on an AI-first product is a material risk.

The documents contain no retention schedule, no deletion mechanism, and no deletion SLA. There is no stated way for a user to request erasure of their uploaded images, prompts, or generated videos. Complete silence on retention and deletion is a high-risk gap.

The Privacy Policy discloses that third-party companies may be used to facilitate, provide, or analyze services, which is a common vendor arrangement. However, no sub-processors are named, no limits on the sharing are stated, and there is no explicit prohibition on selling data. The disclosure is generic and offers the user no meaningful control.

The documents provide no opt-out mechanism of any kind — no way to opt out of data collection, third-party sharing, or any potential training use. Users are directed only to a generic contact page for questions. The complete absence of opt-out options warrants a high-risk rating.

Neither document names any regulatory framework or certification. There is no mention of GDPR, CCPA/CPRA, SOC 2, ISO standards, the EU AI Act, or any other baseline framework. For a service collecting personal data and processing user uploads, this total silence on compliance is high risk.

The documents provide no transparency into model behavior, no explainability commitments, and no auditing rights for users or enterprises. The policies do not even acknowledge that AI models are used. This is a complete gap.

The Privacy Policy makes only a vague, boilerplate assurance of 'appropriate security measures' with no specifics on encryption, access controls, penetration testing, or incident response. There is no breach history disclosure and no reference to a security page or trust center. The Terms explicitly disclaim any guarantee of security.

The documents make no distinction between free and paid tiers and disclose no enterprise-specific data handling terms. All users are subject to the same generic terms regardless of tier. There is no evidence of any enhanced protection for paying customers.

The documents do not address whether staff or contractors may access, read, or review user prompts, uploaded images, or generated outputs. The broad content license and the ability to 'monitor the usage of our services' leave the possibility open without disclosure. This silence is a risk.

Neither document mentions government data requests, law enforcement cooperation, subpoena handling, or dispute resolution beyond a generic termination clause. There is no transparency about how legal demands for user data would be handled. This is a silence-driven gap.

The Privacy Policy discloses collection of name, email, contact details, usage data, and device information including IP address — clearly identified PII. It does not address SPI, but users may upload images that could contain biometric or sensitive content, and the policy is silent on how uploaded image content is treated. Disclosure of standard PII exists but purpose limitation and handling of image content are vague.

Both policies are dated 2025/03/10, which is recent relative to the September 2026 analysis date, but the product surface shows an AI-first image-to-video generation tool (naming an underlying model, 'Seedance', and handling uploaded images and prompts) while neither policy ever mentions AI/ML processing, model training, or third-party model providers. This coverage gap on an AI-first product drives a RED rating despite the recent date.

Two documents were supplied — a Privacy Policy and a Terms of Service — and no contradictions were found between them. They cover different topics with no conflicting statements on licensing, retention, opt-out, or data sharing. Both bear the same effective date of 2025/03/10.